General
-
Target
86c85206d1b307d93a14394cb78d1910f9dcfd0c4c134.exe
-
Size
461KB
-
Sample
210814-8fsmh7brzj
-
MD5
f0fc2455a7cdd023373fd6bef8b066b1
-
SHA1
9e2a0536d71a558a1b3a0fd76bcb9f79670fdb16
-
SHA256
86c85206d1b307d93a14394cb78d1910f9dcfd0c4c134bcec227df7ae8cc2b0d
-
SHA512
c04638b18de0067dacbcf8a0c6547d3cec0bc0e6af8062ba3a26e10c1a888e05658669b5e4530a75d2ef646a7fa64e60a433b54b7d409648ea44eee5011f6ee6
Static task
static1
Behavioral task
behavioral1
Sample
86c85206d1b307d93a14394cb78d1910f9dcfd0c4c134.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
86c85206d1b307d93a14394cb78d1910f9dcfd0c4c134.exe
Resource
win10v20210410
Malware Config
Extracted
raccoon
cd8dc1031358b1aec55cc6bc447df1018b068607
-
url4cnc
https://telete.in/jagressor_kz
Targets
-
-
Target
86c85206d1b307d93a14394cb78d1910f9dcfd0c4c134.exe
-
Size
461KB
-
MD5
f0fc2455a7cdd023373fd6bef8b066b1
-
SHA1
9e2a0536d71a558a1b3a0fd76bcb9f79670fdb16
-
SHA256
86c85206d1b307d93a14394cb78d1910f9dcfd0c4c134bcec227df7ae8cc2b0d
-
SHA512
c04638b18de0067dacbcf8a0c6547d3cec0bc0e6af8062ba3a26e10c1a888e05658669b5e4530a75d2ef646a7fa64e60a433b54b7d409648ea44eee5011f6ee6
-
Raccoon Stealer Payload
-
Suspicious use of NtCreateProcessExOtherParentProcess
-
Downloads MZ/PE file
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-